Preserve concurrent task edits and recover private calendar projections

[martin-forge]

Task edits made from an older modal can restore a recurrence date or a field that an external writer has already changed. Rebase each edit on current frontmatter and publish only the requested fields and their recurrence consequences.

An opt-in Google export setting, Rebuild private task projections, assigns a durable task UUID and marks private, transparent, attendee-free provider events. The existing startup and 15-minute recovery loop can then repair renamed links, provider drift, missing events, duplicate projections and orphaned series or detached occurrences without treating the local index as authority. Ambiguous identities and incomplete source reads stop cleanup. Unchanged projections skip remote writes; managed writes use readback and conditional ETags. Existing unmarked events are adopted only through a task's explicit event binding, and unmarked events are never automatically deleted.

The patch also stops startup on unreadable existing settings, leaves saved mobile Pomodoros paused, generates a token before API/MCP listener startup, and hardens the temporary OAuth callback with an OS-assigned port, one-use state and static response pages.

Validation:

• npm run lint and npm run build:test pass.
• TZ=UTC npm test -- --runInBand: 4,175 tests pass; two failures reproduce unchanged on tag 4.12.5: the ar-SA weekend expectation in issue-782-recurrence-weekdays and missing-value ordering in filterService.userListNormalization.
• Regression tests cover current-frontmatter writes, identity recovery, duplicate/orphan handling, unreadable cohorts, invited-event refusal, ETags, provider drift, callback replay and mobile timer startup.
• Disposable Obsidian and Google Calendar checks exercised an open stale modal followed by external recurrence completion, cold-start creation, offline rename/archive/deletion with local index loss, provider deletion/drift/duplicates, retry recovery, moved-occurrence cleanup, unreadable settings, actual listener authentication and actual loopback callback requests. Physical iPhone activation confirms the patched control is present, task export remains disabled, and startup leaves task files unchanged.

The live canaries ran against stable 4.12.5 plus this patch. The branch now merges current main; the updated branch also builds and reloads successfully in the disposable vault, and GitHub test and build checks pass. This is a proposed opt-in recovery path, with no default change to existing Google export behavior.

[martin-forge]

Superseded by focused, independently buildable PRs: #2291 (concurrent task edits), #2292 (OAuth/API protection), #2293 (optional Calendar recovery), #2294 (unreadable-settings startup), and #2295 (mobile Pomodoro startup). Closing this combined PR so each change can be reviewed and merged separately.